New Approaches to Fraud Deterrence: It's Time to Take a New Look at the Auditing Process

Abstract

Call me a skeptic. Maybe it's because I've investigated a couple of thousand fraud cases over a career now entering its fourth decade. Perhaps it's because questioning is one of a CPA's most valuable talents. While I believe that as a profession we're moving in the right direction, I'm convinced we still have miles to go. The auditing profession's current approach to fraud detection--as well-intended as it is--won't have the impact the public expects until auditors and their firms are willing to invest in improved fraud deterrence and detection skills and resources. In my view, even with SAS no. 99, Consideration of Fraud in a Financial Statement Audit, we're still doing much of what we've always done. This article should provoke thought and debate among CPAs on how we might consider different approaches in the way audits are conducted in order to give the public what it really wants: business enterprises with integrity. DEPROGRAMMING OURSELVES In considering new solutions, it becomes necessary for us to critically examine our current thinking. Over the years, I personally have trained thousands of CPAs in antifraud matters. One question that I frequently ask is, How do we prevent fraud? The answer: Internal control. Oh, really? Under that theory, organizations with adequate controls won't experience fraud. But they do--time and time again. Part of the reason is that no controls exist that provide absolute assurance against fraud. Those who are sufficiently motivated to override or circumvent them usually can find a way. Don't get me wrong: Controls are a vital part of fraud deterrence. However, they need to be considered in a larger context. Fraud is not an accounting problem; it is a social phenomenon. If you strip economic crime of its multitudinous variations, there are but three ways a victim can be unlawfully separated from money: by three, stealth or trickery. While the first two are on the wane, the third is not (see exhibits 1 through 3, pages 73-74). And the reasons have little to do with accounting controls. [ILLUSTRATIONS OMITTED] Robbery, theft and other street crimes are the bailiwick of the young and undereducated. According to the FBI, these kinds of offenses are at a 30-year low. Why? First, our society--because of baby boomers--is aging: There are fewer young people in our population, the net result of which is that there are fewer potential offenders. Second, because of mass media, that smaller pool of young people has learned a very valuable lesson: The best way to rob a bank is to own one. To understand the risk/reward equation, consider just one anecdote from the go-go '90s: Junk-bond king Michael Milkin's earnings, largely illegal, amounted to about $1.2 billion. The government fined him $600 million and he spent 20 months in a federal prison. A thug with a gun holding up a financial institution usually will net less than $5,000 and typically will serve at least five years behind bars. Anyone can perform the simple arithmetic involved in that crime formula. THE CONFUSING ISSUE OF CRIMINAL JUSTICE But before you jump to the conclusion that increasing penalties for crime is die answer, consider another counterintuitive fact: The United States has some of the harshest criminal penalties in the modern world--coupled with the highest crime rates. Criminologists almost universally understand why: Punishment-based deterrence simply doesn't work very well. Nearly 75% of incarcerated inmates are rearrested within three years of their being released, usually For more serious offenses (see exhibit 4, page 75). [ILLUSTRATION OMITTED] If you are thoroughly confused, you should be. That's because classic criminological theory says there are three related factors involved in deterrence: the certainty, swiftness and severity of punishment. Of those factors, the first is by far the most important--if punishment is certain and swift, it doesn't need to be severe. …